alphagov / specialist-publisher

Publishes specialist documents on GOV.UK
https://docs.publishing.service.gov.uk/apps/specialist-publisher.html
MIT License
10 stars 7 forks source link

[CLOSED] XSS Preview Issue fix #198

Closed benilovj closed 8 years ago

benilovj commented 8 years ago

Issue by Themitchell Wednesday 30 July 2014 at 10:23 GMT Originally opened as https://github.com/alphagov/specialist-publisher/pull/198


This PR allows us to use the SafeHtmlValidator in govuk_content_models to protect agains creation of a SpecialistDocument with invalid HTML or which contains Javascript. This means that a SpecialistDocument should not get into the system rather than catching the error later in the chain when we would like to publish a document.

In order to give the user some feedback regarding the document they are creating we now also give the user an error when previewing the document instead of rendering anything which contains Javascript.

We have also managed to remove some noise inside the SpecialistDocument class around errors allowing the SpecialistDocument to not require awareness of errors and validations. This is now pushed into the validators instead.


Themitchell included the following code: https://github.com/alphagov/specialist-publisher/pull/198/commits

benilovj commented 8 years ago

Comment by bestie Wednesday 30 July 2014 at 10:36 GMT


LGTM :shipit:

benilovj commented 8 years ago

Comment by evilstreak Thursday 31 July 2014 at 09:35 GMT


:+1: